Alertas de Seguridad de la Información

M Alto vulnerabilidad

17/08/2026

[CVE-2026-59902] Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2…

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.sctp.SctpMessageCompletionHandler limits incomplete messages and fragment counts but not maxBufferedBytes, allowing unauthenticated peers to exhaust memory with large SCTP fragments. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

17/08/2026

[CVE-2026-59893] sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, SQL_REGEX in sqlparse/key…

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, SQL_REGEX in sqlparse/keywords.py and the per-position loop in sqlparse/lexer.py repeatedly scan unmatched dollar-quoted literal and multiline-comment delimiters, causing quadratic CPU consumption through sqlparse.parse(), sqlparse.format(), and sqlparse.split(). This issue is fixed in version 0.6.0.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

17/08/2026

[CVE-2026-51346] SQL Injection vulnerability in StudIP 6.0.x before 6.0.3 and 5.4.x before 5.4.12 allows a remote att…

SQL Injection vulnerability in StudIP 6.0.x before 6.0.3 and 5.4.x before 5.4.12 allows a remote attacker to execute arbitrary code and obtain sensitive information via the store() functions.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

17/08/2026

[CVE-2026-50768] File Upload vulnerability in T-Systems International GmbH ImageMaster Version: 9.14.2.8.1 allows a r…

File Upload vulnerability in T-Systems International GmbH ImageMaster Version: 9.14.2.8.1 allows a remote attacker to execute arbitrary code via the add attachments feature in the create new document function.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

17/08/2026

[CVE-2026-33437] Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. P…

Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.0.0, the Get Info workflow in app/core/src/main/resources/templates/security/get-info-on-pdf.html inserts untrusted PDF Title and Author metadata into the summary-text element with innerHTML, allowing a malicious PDF to execute stored cross-site scripting when a user clicks Get Info and to…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

17/08/2026

[CVE-2026-9771] The flash_copy() system call is verified by z_vrfy_flash_copy() in drivers/flash/flash_util.c. On bu…

The flash_copy() system call is verified by z_vrfy_flash_copy() in drivers/flash/flash_util.c. On builds with CONFIG_USERSPACE enabled, this handler is the kernel-side trust boundary for a user-mode caller. Prior to the fix it validated only the output buffer (K_SYSCALL_MEMORY_WRITE) and passed the two struct device * arguments, src_dev and dst_dev, directly into the implementation without any obj…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

17/08/2026

[CVE-2026-75060] In JetBrains PyCharm before 2026.2.1 code execution was possible via unauthenticated Jupyter MCP too…

In JetBrains PyCharm before 2026.2.1 code execution was possible via unauthenticated Jupyter MCP tools

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

17/08/2026

[CVE-2026-75056] In JetBrains IntelliJ IDEA before 2026.2.1 rCE via Markdown export tool was possible

In JetBrains IntelliJ IDEA before 2026.2.1 rCE via Markdown export tool was possible

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

17/08/2026

[CVE-2026-75044] In JetBrains YouTrack before 2025.3.156085, 2026.1.13914, 2026.2.18095 missing authorisation allow…

In JetBrains YouTrack before 2025.3.156085, 2026.1.13914, 2026.2.18095 missing authorisation allowed an authenticated user to delete arbitrary entities via the mailbox endpoint

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

17/08/2026

[CVE-2026-75048] In JetBrains YouTrack before 2026.2.18068 stored XSS via the fenced code-block language label was po…

In JetBrains YouTrack before 2026.2.18068 stored XSS via the fenced code-block language label was possible

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

17/08/2026

[CVE-2026-73646] PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rul…

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap() passes attacker-controlled sourceMappingURL values to join(dirname(opts.from), annotation), and loadFile() permits traversed or absolute .map paths, allowing untrusted CSS processed without map: false to disclose sources…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

17/08/2026

[CVE-2026-71479] New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management sys…

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 1.0.0-rc.18, user-controlled image n, video seconds and duration, max_tokens, max_completion_tokens, maxOutputTokens, audio duration, and billing-expression quantities can overflow conversions in common/quota_math.go and related settlement paths, allowing a low-privileged account with …

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

17/08/2026

[CVE-2026-56090] Dell ObjectScale, versions prior to 4.3.0.1, contain(s) an Uncontrolled Search Path Element vulnerab…

Dell ObjectScale, versions prior to 4.3.0.1, contain(s) an Uncontrolled Search Path Element vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

17/08/2026

[CVE-2026-56685] Dell ObjectScale, versions prior to 4.3.0.1, contain(s) an Improper Neutralization of Special Elemen…

Dell ObjectScale, versions prior to 4.3.0.1, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Command execution.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

17/08/2026

[CVE-2026-56686] Dell ObjectScale, versions prior to 4.3.0.1, contain(s) an Improper Neutralization of Special Elemen…

Dell ObjectScale, versions prior to 4.3.0.1, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

17/08/2026

[CVE-2026-59909] Dell ObjectScale, versions prior to 4.3.0.1, contain(s) a Path Traversal vulnerability. A low privil…

Dell ObjectScale, versions prior to 4.3.0.1, contain(s) a Path Traversal vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information tampering.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

17/08/2026

[CVE-2026-59910] Dell ObjectScale, versions prior to 4.3.0.1, contain(s) an Improper Neutralization of Special Elemen…

Dell ObjectScale, versions prior to 4.3.0.1, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

17/08/2026

[CVE-2026-19693] extract-zip through 2.0.1 containment-checks only the parent directory of each archive entry and nev…

extract-zip through 2.0.1 containment-checks only the parent directory of each archive entry and never the entry's own final path component, so an archive containing two entries with identical names - a symlink whose target is outside the destination, followed by a regular file - writes through the planted symlink and yields an arbitrary file write outside the destination directory.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

17/08/2026

[CVE-2026-15218] A flaw was found in the maas-api and maas-controller ServiceAccounts within Red Hat OpenShift AI. Th…

A flaw was found in the maas-api and maas-controller ServiceAccounts within Red Hat OpenShift AI. These ServiceAccounts are granted cluster-wide permissions that exceed their operational requirements. An attacker who compromises the identity of these ServiceAccounts, either through a remote code execution vulnerability or by creating a malicious pod in the same namespace, could exploit these exces…

nvdaltovulnerabilidad CVSS 7.9 NVD

M Alto vulnerabilidad

17/08/2026

[CVE-2026-16137] In Progress ShareFile Storage Zones Controller v5.12.5 and below, a party with valid zone credential…

In Progress ShareFile Storage Zones Controller v5.12.5 and below, a party with valid zone credentials can perform path traversal using resumable upload initiation endpoint, allowing the party to write arbitrary content to any location writable by the application's service account. This may result in the execution of attacker-supplied code.

nvdaltovulnerabilidad CVSS 7.2 NVD